@getstrata/bootstrap 0.2.49 → 0.2.50

package/dist/entries/health.js

@@ -2,148 +2,16 @@
 var __jsonParse = (a) => JSON.parse(a);
 
 // ../../src/bootstrap/health.ts
+import { getBoundDatabaseConnection } from "@getstrata/core/database/boundConnection";
+import { getDefaultDatabasePool } from "@getstrata/core/database/defaultConnection";
 import { jsonResponse } from "@getstrata/core/http/response";
 var {RedisClient } = globalThis.Bun;
 
-// ../../src/config/database.ts
-function readInteger(name, fallback) {
-  const parsed = Number.parseInt(process.env[name] ?? String(fallback), 10);
-  return Number.isInteger(parsed) && parsed >= 0 ? parsed : fallback;
-}
-var databaseConfig = {
-  url: process.env.DATABASE_URL ?? "",
-  poolMax: readInteger("DB_POOL_MAX", 10),
-  idleTimeoutSeconds: readInteger("DB_POOL_IDLE_TIMEOUT", 30),
-  maxLifetimeSeconds: readInteger("DB_POOL_MAX_LIFETIME", 3600),
-  connectionTimeoutSeconds: readInteger("DB_CONNECTION_TIMEOUT", 10)
-};
-
-// ../../src/core/runtime/asyncContextStore.ts
-import { AsyncLocalStorage } from "async_hooks";
-function createAsyncContextStore(key) {
-  const symbol = Symbol.for(key);
-  const globalRecord = globalThis;
-  const existing = globalRecord[symbol];
-  if (existing) {
-    return existing;
-  }
-  const store = new AsyncLocalStorage;
-  globalRecord[symbol] = store;
-  return store;
-}
-
-// ../../src/core/database/connectionContext.ts
-var activeConnection = createAsyncContextStore("@getstrata/databaseConnectionContext");
-function getActiveDatabaseConnection(fallback) {
-  return activeConnection.getStore() ?? fallback;
-}
-
-// ../../src/core/database/queryProxy.ts
-var POOL_CONNECTION_METHODS = new Set(["begin", "close", "connect"]);
-function createDatabaseQueryProxy(pool) {
-  function resolveDatabase() {
-    return getActiveDatabaseConnection(pool);
-  }
-  function resolveDatabaseForProperty(property) {
-    if (typeof property === "string" && POOL_CONNECTION_METHODS.has(property)) {
-      return pool;
-    }
-    return resolveDatabase();
-  }
-  return new Proxy(function database() {}, {
-    apply(_target, _thisArg, args) {
-      return resolveDatabase()(...args);
-    },
-    get(_target, property) {
-      const connection = resolveDatabaseForProperty(property);
-      const value = connection[property];
-      return typeof value === "function" ? value.bind(connection) : value;
-    }
-  });
-}
-
-// ../../src/core/database/defaultConnection.ts
-var defaultPool = {
-  connection: null
-};
-var defaultQuery = {
-  connection: null
-};
-function registerDefaultDatabasePool(connection) {
-  defaultPool.connection = connection;
-  defaultQuery.connection = createDatabaseQueryProxy(connection);
-}
-function getDefaultDatabaseQuery() {
-  if (!defaultQuery.connection) {
-    throw new Error("Default database query handle is not registered. Call registerDefaultDatabasePool() during app bootstrap.");
-  }
-  return defaultQuery.connection;
-}
-
-// ../../src/db/connection/createConnection.ts
-var {SQL } = globalThis.Bun;
-function createDatabaseConnection(config) {
-  if (!config.url) {
-    throw new Error("DATABASE_URL is not configured. Set DATABASE_URL before starting the app or running integration tests.");
-  }
-  return new SQL({
-    url: config.url,
-    max: config.poolMax,
-    idleTimeout: config.idleTimeoutSeconds,
-    maxLifetime: config.maxLifetimeSeconds,
-    connectionTimeout: config.connectionTimeoutSeconds
-  });
-}
-
-// ../../src/db/connection/index.ts
-var connectionHolder = {
-  connection: null
-};
-function getDatabase() {
-  if (!connectionHolder.connection) {
-    connectionHolder.connection = createDatabaseConnection(databaseConfig);
-    registerDefaultDatabasePool(connectionHolder.connection);
-  }
-  return connectionHolder.connection;
-}
-function getDb() {
-  getDatabase();
-  return getDefaultDatabaseQuery();
-}
-async function pingDatabase(connection = getDatabase()) {
-  try {
-    await connection`SELECT 1`;
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function ensureDatabaseConnection() {
-  if (await pingDatabase()) {
-    return getDatabase();
-  }
-  await getDatabase().close().catch(() => {
-    return;
-  });
-  connectionHolder.connection = createDatabaseConnection(databaseConfig);
-  registerDefaultDatabasePool(connectionHolder.connection);
-  return getDatabase();
-}
-var db = new Proxy(function database() {}, {
-  apply(_target, _thisArg, args) {
-    return getDb()(...args);
-  },
-  get(_target, property) {
-    const connection = getDb();
-    const value = connection[property];
-    return typeof value === "function" ? value.bind(connection) : value;
-  }
-});
-var connection_default = db;
-
 // ../../src/bootstrap/config.ts
 import {
+  CORE_ABILITY_CHECKER_TOKEN,
   CORE_AUTH_TOKEN,
+  CORE_AUTH_USER_DIRECTORY_TOKEN,
   CORE_CACHE_TOKEN,
   CORE_CONFIG_TOKEN,
   CORE_EVENT_BUS_TOKEN,
@@ -174,9 +42,34 @@ function resolveRedisUrl(dependencies) {
   const redisUrl = config.get(REDIS_URL_CONFIG_KEY)?.trim();
   return redisUrl || undefined;
 }
+function resolveHealthDatabase() {
+  const bound = getBoundDatabaseConnection();
+  if (bound) {
+    return bound;
+  }
+  try {
+    return getDefaultDatabasePool();
+  } catch {
+    return null;
+  }
+}
+async function pingDatabaseClient(connection) {
+  try {
+    await connection.unsafe("SELECT 1");
+    return true;
+  } catch {
+    return false;
+  }
+}
 async function checkDatabase() {
-  await ensureDatabaseConnection();
-  return await pingDatabase();
+  const connection = resolveHealthDatabase();
+  if (!connection) {
+    return false;
+  }
+  return await pingDatabaseClient(connection);
+}
+async function pingDatabase() {
+  return await checkDatabase();
 }
 async function checkRedis(redisUrl) {
   try {
@@ -187,23 +80,46 @@ async function checkRedis(redisUrl) {
     return false;
   }
 }
-function createHealthRoutes(dependencies) {
+async function resolveExtraFields(extra) {
+  if (!extra) {
+    return {};
+  }
+  return typeof extra === "function" ? await extra() : extra;
+}
+async function collectDependencyChecks(dependencies) {
+  const checks = {
+    database: await checkDatabase() ? "ok" : "error"
+  };
+  const redisUrl = resolveRedisUrl(dependencies);
+  if (redisUrl) {
+    checks.redis = await checkRedis(redisUrl) ? "ok" : "error";
+  } else {
+    checks.redis = "skipped";
+  }
+  const ready = checks.database === "ok" && (checks.redis === "ok" || checks.redis === "skipped");
+  return { checks, ready };
+}
+function createHealthRoutes(dependencies, options = {}) {
   return {
-    "/health": async () => jsonResponse({ status: "ok" }),
-    "/ready": async () => {
-      const checks = {
-        database: await checkDatabase() ? "ok" : "error"
-      };
-      const redisUrl = resolveRedisUrl(dependencies);
-      if (redisUrl) {
-        checks.redis = await checkRedis(redisUrl) ? "ok" : "error";
-      } else {
-        checks.redis = "skipped";
+    "/health": async () => {
+      const extra = await resolveExtraFields(options.extra);
+      if (!options.pingOnHealth) {
+        return jsonResponse({ status: "ok", ...extra });
       }
-      const ready = checks.database === "ok" && (checks.redis === "ok" || checks.redis === "skipped");
+      const { checks, ready } = await collectDependencyChecks(dependencies);
+      return jsonResponse({
+        status: ready ? "ok" : "error",
+        checks,
+        ...extra
+      }, { status: ready ? 200 : 503 });
+    },
+    "/ready": async () => {
+      const extra = await resolveExtraFields(options.extra);
+      const { checks, ready } = await collectDependencyChecks(dependencies);
       return jsonResponse({
         status: ready ? "ready" : "not_ready",
-        checks
+        checks,
+        ...extra
       }, { status: ready ? 200 : 503 });
     }
   };
@@ -211,5 +127,6 @@ function createHealthRoutes(dependencies) {
 export {
   checkDatabase,
   checkRedis,
-  createHealthRoutes
+  createHealthRoutes,
+  pingDatabase
 };

package/dist/entries/httpKernel.js

@@ -3,6 +3,7 @@ var __jsonParse = (a) => JSON.parse(a);
 
 // ../../src/bootstrap/httpKernel.ts
 import { createMembershipMiddleware } from "@getstrata/core/auth/membershipMiddleware";
+import { resolveAbilityChecker } from "@getstrata/core/contracts/serviceTokens";
 import { createAuthMiddleware } from "@getstrata/core/http/authMiddleware";
 import { createAuthorizeMiddleware } from "@getstrata/core/http/authorizeMiddleware";
 import { createBodySizeLimitMiddleware } from "@getstrata/core/http/bodySizeLimitMiddleware";
@@ -63,24 +64,38 @@ function parsePositiveInt(value, fallback) {
   }
   return Math.trunc(parsed);
 }
+function parseWindowSeconds(secondsValue, msValue, fallback) {
+  if (secondsValue !== undefined && secondsValue.trim() !== "") {
+    return parsePositiveInt(secondsValue, fallback);
+  }
+  if (msValue !== undefined && msValue.trim() !== "") {
+    const parsedMs = Number(msValue);
+    if (Number.isFinite(parsedMs) && parsedMs > 0) {
+      return Math.max(1, Math.trunc(parsedMs / 1000));
+    }
+  }
+  return fallback;
+}
 function resolveLoginRateLimit() {
   const defaults = isLocalAppEnv() ? LOCAL_LOGIN_RATE_LIMIT : PRODUCTION_LOGIN_RATE_LIMIT;
   return {
     maxAttempts: parsePositiveInt(process.env.LOGIN_RATE_LIMIT_PER_WINDOW, defaults.maxAttempts),
-    decaySeconds: parsePositiveInt(process.env.LOGIN_RATE_LIMIT_WINDOW_SECONDS, defaults.decaySeconds)
+    decaySeconds: parseWindowSeconds(process.env.LOGIN_RATE_LIMIT_WINDOW_SECONDS, process.env.LOGIN_RATE_LIMIT_WINDOW_MS, defaults.decaySeconds)
   };
 }
 function resolveRegisterRateLimit() {
   const defaults = isLocalAppEnv() ? { maxAttempts: 100, decaySeconds: 60 } : { maxAttempts: 10, decaySeconds: 60 };
   return {
     maxAttempts: parsePositiveInt(process.env.REGISTER_RATE_LIMIT_PER_WINDOW, defaults.maxAttempts),
-    decaySeconds: parsePositiveInt(process.env.REGISTER_RATE_LIMIT_WINDOW_SECONDS ?? process.env.REGISTER_RATE_LIMIT_WINDOW_MS ? String(Number(process.env.REGISTER_RATE_LIMIT_WINDOW_MS) / 1000) : undefined, defaults.decaySeconds)
+    decaySeconds: parseWindowSeconds(process.env.REGISTER_RATE_LIMIT_WINDOW_SECONDS, process.env.REGISTER_RATE_LIMIT_WINDOW_MS, defaults.decaySeconds)
   };
 }
 
 // ../../src/bootstrap/config.ts
 import {
+  CORE_ABILITY_CHECKER_TOKEN,
   CORE_AUTH_TOKEN,
+  CORE_AUTH_USER_DIRECTORY_TOKEN,
   CORE_CACHE_TOKEN,
   CORE_CONFIG_TOKEN,
   CORE_EVENT_BUS_TOKEN,
@@ -184,7 +199,7 @@ class HttpKernel {
   }
   wrapWebAbility(ability, handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
-    const abilityChecker = this.dependencies.container.resolve(CORE_TOKEN_SERVICE_TOKEN);
+    const abilityChecker = resolveAbilityChecker(this.dependencies.container);
     const requireAbility = createRequireAbilityMiddleware(abilityChecker);
     const middleware = [createRequireWebAuthMiddleware(auth), requireAbility(ability)];
     return this.wrapWeb(withMiddleware(...middleware)(handler));
@@ -208,7 +223,7 @@ class HttpKernel {
     return withMiddleware(...middleware)(handler);
   }
   wrapAbility(ability, handler) {
-    const abilityChecker = this.dependencies.container.resolve(CORE_TOKEN_SERVICE_TOKEN);
+    const abilityChecker = resolveAbilityChecker(this.dependencies.container);
     const requireAbility = createRequireAbilityMiddleware(abilityChecker);
     const middleware = [...this.group("authenticated"), requireAbility(ability)];
     return withMiddleware(...middleware)(handler);

package/dist/entries/providers.js

@@ -18,7 +18,9 @@ var authConfig = {
 
 // ../../src/bootstrap/config.ts
 import {
+  CORE_ABILITY_CHECKER_TOKEN,
   CORE_AUTH_TOKEN,
+  CORE_AUTH_USER_DIRECTORY_TOKEN,
   CORE_CACHE_TOKEN,
   CORE_CONFIG_TOKEN,
   CORE_EVENT_BUS_TOKEN,

package/dist/entries/secretsGuard.js

@@ -5,6 +5,7 @@ var __jsonParse = (a) => JSON.parse(a);
 var DEFAULT_ADMIN_API_TOKEN = "workhub-admin-test-token";
 var DEFAULT_MEMBER_API_TOKEN = "workhub-member-test-token";
 var DEFAULT_SCIM_BEARER_TOKEN = "workhub-scim-test-token";
+var MIN_SESSION_SECRET_LENGTH = 32;
 var DEFAULT_TOKENS = new Set([DEFAULT_ADMIN_API_TOKEN, DEFAULT_MEMBER_API_TOKEN]);
 var DEFAULT_SCIM_TOKENS = new Set([DEFAULT_SCIM_BEARER_TOKEN]);
 function isEnabled(value, defaultEnabled) {
@@ -13,19 +14,31 @@ function isEnabled(value, defaultEnabled) {
   }
   return defaultEnabled ? value !== "false" : value === "true";
 }
-function assertProductionSecrets(env = process.env) {
-  const appEnv = env.APP_ENV ?? "local";
-  if (appEnv !== "production") {
-    return;
+function isTokenAuthEnabled(env) {
+  return Boolean(env.ADMIN_API_TOKEN?.trim()) || Boolean(env.MEMBER_API_TOKEN?.trim()) || env.FEATURE_API_TOKENS === "true";
+}
+function isOAuthEnabled(env) {
+  return isEnabled(env.FEATURE_OAUTH, false) || isEnabled(env.FEATURE_SAML, false) || Boolean(env.GITHUB_CLIENT_ID?.trim()) || Boolean(env.OIDC_ISSUER?.trim()) || Boolean(env.SAML_LOGIN_URL?.trim());
+}
+function isCorsConfigured(env) {
+  return env.CORS_ALLOWED_ORIGINS !== undefined;
+}
+function assertAuthDevHeadersDisabled(env) {
+  if (isEnabled(env.AUTH_DEV_HEADERS, true)) {
+    throw new Error("Production startup blocked: set AUTH_DEV_HEADERS=false to disable development auth headers.");
   }
+}
+function assertSessionSecret(env) {
+  const secret = env.SESSION_SECRET?.trim() ?? "";
+  if (secret.length < MIN_SESSION_SECRET_LENGTH) {
+    throw new Error("Production startup blocked: set SESSION_SECRET when FRONTEND_MODE=server-htmx (32+ characters).");
+  }
+}
+function assertWorkHubProductionSecrets(env) {
   const adminToken = env.ADMIN_API_TOKEN ?? DEFAULT_ADMIN_API_TOKEN;
   const memberToken = env.MEMBER_API_TOKEN ?? DEFAULT_MEMBER_API_TOKEN;
   const scimToken = env.SCIM_BEARER_TOKEN ?? DEFAULT_SCIM_BEARER_TOKEN;
   const encryptionEnabled = isEnabled(env.FEATURE_FIELD_ENCRYPTION, true);
-  const devHeadersEnabled = isEnabled(env.AUTH_DEV_HEADERS, true);
-  if (devHeadersEnabled) {
-    throw new Error("Production startup blocked: set AUTH_DEV_HEADERS=false to disable development auth headers.");
-  }
   if (DEFAULT_TOKENS.has(adminToken) || DEFAULT_TOKENS.has(memberToken)) {
     throw new Error("Production startup blocked: rotate ADMIN_API_TOKEN and MEMBER_API_TOKEN away from default WorkHub test values.");
   }
@@ -57,9 +70,50 @@ function assertProductionSecrets(env = process.env) {
   if (!env.API_TOKEN_DEFAULT_EXPIRY_DAYS?.trim()) {
     throw new Error("Production startup blocked: set API_TOKEN_DEFAULT_EXPIRY_DAYS to enforce token rotation.");
   }
+}
+function assertSiblingProductionSecrets(env) {
+  if (isEnabled(env.FEATURE_SCIM, false)) {
+    const scimToken = env.SCIM_BEARER_TOKEN ?? DEFAULT_SCIM_BEARER_TOKEN;
+    if (DEFAULT_SCIM_TOKENS.has(scimToken) || !env.SCIM_BEARER_TOKEN?.trim()) {
+      throw new Error("Production startup blocked: rotate SCIM_BEARER_TOKEN away from default WorkHub test values.");
+    }
+  }
+  if (isEnabled(env.FEATURE_FIELD_ENCRYPTION, false) && !env.KMS_ENCRYPTION_KEY?.trim()) {
+    throw new Error("Production startup blocked: set KMS_ENCRYPTION_KEY when field encryption is enabled.");
+  }
+  if (isEnabled(env.FEATURE_BILLING, false) && !env.STRIPE_WEBHOOK_SECRET?.trim()) {
+    throw new Error("Production startup blocked: set STRIPE_WEBHOOK_SECRET when billing webhooks are enabled.");
+  }
+  if (isOAuthEnabled(env) && !env.OAUTH_STATE_SECRET?.trim()) {
+    throw new Error("Production startup blocked: set OAUTH_STATE_SECRET for OAuth CSRF protection.");
+  }
+  if (isCorsConfigured(env)) {
+    const corsOrigins = (env.CORS_ALLOWED_ORIGINS ?? "*").split(",").map((origin) => origin.trim());
+    if (corsOrigins.includes("*")) {
+      throw new Error("Production startup blocked: set explicit CORS_ALLOWED_ORIGINS instead of wildcard.");
+    }
+  }
+  if (isEnabled(env.FEATURE_PUBLIC_READS, false)) {
+    throw new Error("Production startup blocked: set FEATURE_PUBLIC_READS=false for authenticated-only reads.");
+  }
+  if (!env.SIEM_EXPORT_URL?.trim() && isEnabled(env.FEATURE_SIEM_EXPORT, false)) {
+    console.warn("[secrets] SIEM_EXPORT_URL is not configured; audit logs remain database-only.");
+  }
+}
+function assertProductionSecrets(env = process.env) {
+  const appEnv = env.APP_ENV ?? "local";
+  if (appEnv !== "production") {
+    return;
+  }
+  assertAuthDevHeadersDisabled(env);
+  if (isTokenAuthEnabled(env)) {
+    assertWorkHubProductionSecrets(env);
+  } else {
+    assertSiblingProductionSecrets(env);
+  }
   const frontendMode = (env.FRONTEND_MODE ?? "api").trim();
-  if (frontendMode === "server-htmx" && !env.SESSION_SECRET?.trim()) {
-    throw new Error("Production startup blocked: set SESSION_SECRET when FRONTEND_MODE=server-htmx.");
+  if (frontendMode === "server-htmx") {
+    assertSessionSecret(env);
   }
 }
 export {

package/dist/entries/web/routing.js

@@ -12,6 +12,7 @@ import {
 
 // ../../src/bootstrap/httpKernel.ts
 import { createMembershipMiddleware } from "@getstrata/core/auth/membershipMiddleware";
+import { resolveAbilityChecker } from "@getstrata/core/contracts/serviceTokens";
 import { createAuthMiddleware } from "@getstrata/core/http/authMiddleware";
 import { createAuthorizeMiddleware } from "@getstrata/core/http/authorizeMiddleware";
 import { createBodySizeLimitMiddleware } from "@getstrata/core/http/bodySizeLimitMiddleware";
@@ -72,24 +73,38 @@ function parsePositiveInt(value, fallback) {
   }
   return Math.trunc(parsed);
 }
+function parseWindowSeconds(secondsValue, msValue, fallback) {
+  if (secondsValue !== undefined && secondsValue.trim() !== "") {
+    return parsePositiveInt(secondsValue, fallback);
+  }
+  if (msValue !== undefined && msValue.trim() !== "") {
+    const parsedMs = Number(msValue);
+    if (Number.isFinite(parsedMs) && parsedMs > 0) {
+      return Math.max(1, Math.trunc(parsedMs / 1000));
+    }
+  }
+  return fallback;
+}
 function resolveLoginRateLimit() {
   const defaults = isLocalAppEnv() ? LOCAL_LOGIN_RATE_LIMIT : PRODUCTION_LOGIN_RATE_LIMIT;
   return {
     maxAttempts: parsePositiveInt(process.env.LOGIN_RATE_LIMIT_PER_WINDOW, defaults.maxAttempts),
-    decaySeconds: parsePositiveInt(process.env.LOGIN_RATE_LIMIT_WINDOW_SECONDS, defaults.decaySeconds)
+    decaySeconds: parseWindowSeconds(process.env.LOGIN_RATE_LIMIT_WINDOW_SECONDS, process.env.LOGIN_RATE_LIMIT_WINDOW_MS, defaults.decaySeconds)
   };
 }
 function resolveRegisterRateLimit() {
   const defaults = isLocalAppEnv() ? { maxAttempts: 100, decaySeconds: 60 } : { maxAttempts: 10, decaySeconds: 60 };
   return {
     maxAttempts: parsePositiveInt(process.env.REGISTER_RATE_LIMIT_PER_WINDOW, defaults.maxAttempts),
-    decaySeconds: parsePositiveInt(process.env.REGISTER_RATE_LIMIT_WINDOW_SECONDS ?? process.env.REGISTER_RATE_LIMIT_WINDOW_MS ? String(Number(process.env.REGISTER_RATE_LIMIT_WINDOW_MS) / 1000) : undefined, defaults.decaySeconds)
+    decaySeconds: parseWindowSeconds(process.env.REGISTER_RATE_LIMIT_WINDOW_SECONDS, process.env.REGISTER_RATE_LIMIT_WINDOW_MS, defaults.decaySeconds)
   };
 }
 
 // ../../src/bootstrap/config.ts
 import {
+  CORE_ABILITY_CHECKER_TOKEN,
   CORE_AUTH_TOKEN,
+  CORE_AUTH_USER_DIRECTORY_TOKEN,
   CORE_CACHE_TOKEN,
   CORE_CONFIG_TOKEN,
   CORE_EVENT_BUS_TOKEN,
@@ -193,7 +208,7 @@ class HttpKernel {
   }
   wrapWebAbility(ability, handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
-    const abilityChecker = this.dependencies.container.resolve(CORE_TOKEN_SERVICE_TOKEN);
+    const abilityChecker = resolveAbilityChecker(this.dependencies.container);
     const requireAbility = createRequireAbilityMiddleware(abilityChecker);
     const middleware = [createRequireWebAuthMiddleware(auth), requireAbility(ability)];
     return this.wrapWeb(withMiddleware(...middleware)(handler));
@@ -217,7 +232,7 @@ class HttpKernel {
     return withMiddleware(...middleware)(handler);
   }
   wrapAbility(ability, handler) {
-    const abilityChecker = this.dependencies.container.resolve(CORE_TOKEN_SERVICE_TOKEN);
+    const abilityChecker = resolveAbilityChecker(this.dependencies.container);
     const requireAbility = createRequireAbilityMiddleware(abilityChecker);
     const middleware = [...this.group("authenticated"), requireAbility(ability)];
     return withMiddleware(...middleware)(handler);

package/dist/entries/web/session.js

@@ -3,15 +3,40 @@ var __jsonParse = (a) => JSON.parse(a);
 
 // ../../src/bootstrap/web/session.ts
 import { createHash, randomBytes } from "crypto";
+import { AuthManager } from "@getstrata/core/auth/guard";
+import { getBoundDatabaseConnection } from "@getstrata/core/database/boundConnection";
+import { getDefaultDatabasePool } from "@getstrata/core/database/defaultConnection";
 import { readRequestCookie } from "@getstrata/core/http/cookies";
+function isSqlClient(value) {
+  return typeof value.unsafe === "function";
+}
+function resolveSql(source) {
+  if (isSqlClient(source)) {
+    return source;
+  }
+  return source();
+}
+function defaultSessionSql() {
+  const bound = getBoundDatabaseConnection();
+  if (bound) {
+    return bound;
+  }
+  return getDefaultDatabasePool();
+}
+function defaultMapSessionUser(user) {
+  return {
+    id: user.id,
+    role: user.is_admin ? "admin" : "member"
+  };
+}
 
 class CookieSessionStore {
-  sql;
+  sqlSource;
   secret;
   cookieName;
   maxAgeSeconds;
-  constructor(sql, secret, cookieName = "strata_session", maxAgeSeconds = 60 * 60 * 24 * 14) {
-    this.sql = sql;
+  constructor(sqlSource, secret, cookieName = "strata_session", maxAgeSeconds = 60 * 60 * 24 * 14) {
+    this.sqlSource = sqlSource;
     this.secret = secret;
     this.cookieName = cookieName;
     this.maxAgeSeconds = maxAgeSeconds;
@@ -29,10 +54,13 @@ class CookieSessionStore {
     }
     return header.includes("Secure") ? header : `${header}; Secure`;
   }
+  sql() {
+    return resolveSql(this.sqlSource);
+  }
   async create(user) {
     const id = randomBytes(32).toString("hex");
     const expires = new Date(Date.now() + this.maxAgeSeconds * 1000);
-    await this.sql.unsafe(`INSERT INTO sessions (id, user_id, expires_at) VALUES ($1, $2, $3)`, [
+    await this.sql().unsafe(`INSERT INTO sessions (id, user_id, expires_at) VALUES ($1, $2, $3)`, [
       id,
       user.id,
       expires
@@ -40,7 +68,7 @@ class CookieSessionStore {
     return id;
   }
   async destroy(sessionId) {
-    await this.sql.unsafe(`DELETE FROM sessions WHERE id = $1`, [sessionId]);
+    await this.sql().unsafe(`DELETE FROM sessions WHERE id = $1`, [sessionId]);
   }
   async read(request) {
     const cookie = readRequestCookie(request, this.cookieName);
@@ -51,7 +79,7 @@ class CookieSessionStore {
     if (!sessionId || !signature || signature !== this.sign(sessionId)) {
       return null;
     }
-    const rows = await this.sql.unsafe(`SELECT s.id, s.user_id, s.expires_at, u.name, u.email, u.learn_subscriber,
+    const rows = await this.sql().unsafe(`SELECT s.id, s.user_id, s.expires_at, u.name, u.email, u.learn_subscriber,
               COALESCE(u.is_admin, false) AS is_admin
        FROM sessions s
        INNER JOIN users u ON u.id = s.user_id
@@ -71,6 +99,30 @@ class CookieSessionStore {
     return createHash("sha256").update(`${value}.${this.secret}`).digest("hex").slice(0, 32);
   }
 }
+
+class CookieSessionGuard {
+  store;
+  mapUser;
+  constructor(store, mapUser = defaultMapSessionUser) {
+    this.store = store;
+    this.mapUser = mapUser;
+  }
+  async resolve(request) {
+    const user = await this.store.read(request);
+    if (!user) {
+      return null;
+    }
+    return this.mapUser(user);
+  }
+}
+function createCookieSessionAuthManager(options = {}) {
+  const store = options.store ?? new CookieSessionStore(options.sql ?? defaultSessionSql, options.secret ?? process.env.SESSION_SECRET?.trim() ?? "", options.cookieName, options.maxAgeSeconds);
+  return new AuthManager(new CookieSessionGuard(store, options.mapUser ?? defaultMapSessionUser));
+}
 export {
-  CookieSessionStore
+  CookieSessionGuard,
+  CookieSessionStore,
+  createCookieSessionAuthManager,
+  defaultMapSessionUser,
+  defaultSessionSql
 };